CVE-2026-17818: Google Chrome UXSS Vulnerability

CVE-2026-17818 Overview

CVE-2026-17818 is a Universal Cross-Site Scripting (UXSS) vulnerability in the Network component of Google Chrome. Versions prior to 151.0.7922.72 contain an inappropriate implementation that allows a remote attacker to inject arbitrary scripts or HTML through a crafted HTML page. Chromium security assigned this issue a Medium severity rating.

Successful exploitation breaks the browser's same-origin policy. An attacker can execute script in the context of any origin the victim visits, exposing session data, credentials, and authenticated actions across sites.

Critical Impact
Remote attackers can bypass same-origin policy through a crafted HTML page, enabling script or HTML injection into arbitrary web origins loaded by the victim's browser.

Affected Products

Google Chrome (Desktop) versions prior to 151.0.7922.72
Chromium-based browsers incorporating the vulnerable Network component
Downstream Chromium forks that have not merged the upstream fix

Discovery Timeline

2026-07-30 - CVE-2026-17818 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17818

Vulnerability Analysis

The flaw resides in Chrome's Network stack, which handles resource fetching, response parsing, and cross-origin enforcement. An inappropriate implementation in this component causes the browser to mishandle content in a way that permits Universal Cross-Site Scripting.

Unlike traditional reflected or stored XSS, UXSS abuses the browser itself. The attacker does not need a vulnerable web application. The browser's own logic executes attacker-controlled script in the security context of a targeted origin.

Root Cause

The root cause is an inappropriate implementation within Chrome's Network handling. Google has not publicly released source-level detail beyond the advisory. Refer to the Google Chrome Update Announcement and the Chromium Issue Tracker Entry for further disclosure as it becomes available.

Attack Vector

Exploitation requires a victim to load a crafted HTML page controlled by the attacker. Typical delivery paths include phishing links, malicious advertisements, or compromised third-party content embedded on trusted sites. Once the page is loaded, the flawed network behavior allows scripts or HTML supplied by the attacker to execute against another origin the victim interacts with.

No authentication or elevated privileges are required. User interaction is limited to visiting the malicious page.

No verified public exploit code is available. The vulnerability is described in prose only. See the vendor advisory for further technical detail.

Detection Methods for CVE-2026-17818

Indicators of Compromise

Chrome desktop clients reporting a version earlier than 151.0.7922.72 in enterprise inventory
Unexpected script execution or DOM modification on trusted origins following visits to unfamiliar HTML pages
Outbound requests from browser processes to newly registered or low-reputation domains hosting HTML payloads

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag builds below 151.0.7922.72
Correlate browser process telemetry with visits to untrusted URLs immediately preceding anomalous authenticated actions
Inspect web proxy logs for HTML responses containing script injection patterns delivered to Chrome user agents

Monitoring Recommendations

Track Chrome auto-update status and surface endpoints where updates are blocked or delayed
Alert on credential reuse or session token access from browser child processes following visits to attacker-controlled pages
Monitor for phishing campaigns delivering HTML attachments or short-lived hosting infrastructure targeting Chrome users

How to Mitigate CVE-2026-17818

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Verify Chromium-based browsers in the environment have merged the upstream fix before permitting continued use
Restart browser sessions after patching to ensure the vulnerable Network component is unloaded

Patch Information

Google addressed CVE-2026-17818 in Chrome Stable channel version 151.0.7922.72. Distribution details are published in the Google Chrome Update Announcement. Enterprise administrators should deploy the update through managed channels or allow Chrome's built-in updater to complete.

Workarounds

Restrict browsing to trusted sites through web filtering while patch deployment is in progress
Enforce Chrome auto-update policies via group policy or MDM to prevent version drift
Use browser isolation for high-risk user cohorts until all endpoints report a patched version

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv